{
 "id": "WPSEC-2026-1244",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1244/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1244/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1244/index.md",
 "title": "Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng <= 4.1.1 - Unauthenticated Authentication Bypass to Order Payment Confirmation via Webhook",
 "description": "The Casso Flow plugin for WordPress is vulnerable to authentication bypass in the bank transfer webhook handler in all versions up to, and including, 4.1.1 due to the secure token check accepting an empty token when no secure token has been configured. This makes it possible for unauthenticated attackers to send forged webhook requests that mark orders as paid, on sites where the webhook secure token is empty (for example fresh or misconfigured installations).",
 "plugin": {
  "slug": "casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang",
  "name": "Casso – Tự động xác nhận thanh toán chuyển khoản ngân hàng",
  "full_name": "Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng",
  "wordpress_org": "https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/",
  "advisories_url": "https://wpsec.com/vuln/plugin/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.0",
 "remediation": "Update to 4.2.0 or later.",
 "fix_released": "2026-10-18T08:16:15+00:00",
 "published": "2026-10-19T08:48:41+00:00",
 "updated": "2026-10-18T10:55:49.135633+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1244/",
  "https://plugins.svn.wordpress.org/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/tags/4.2.0/",
  "https://wordpress.org/plugins/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/casso-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-19"
 }
}